IT staff have discovered a phishing scam email which asks the recipient to reply with their password. It takes advantage of the recipient's fear and presents a sense of urgency.
The email has a subject of "YOUR ACCOUNT MAY BE DELETED IN TWO DAYS TIME". It claims to be from "VCU (Virginia Commonwealth University)
web-mail Customer Care" and asks the sender to reply to to an email address that was not a vcu.edu email address. Some of the emails were sent from a VCU user's email account which had been compromised.
The email tells the recipient that "web_mail" accounts are being shut down due to a problem that was discovered and asks the recipient to send their username, password, date of birth and country or territory to avoid having their account suspended.
VCU prohibits sharing your password
VCU's Technology Services staff and other VCU business units will never ask you to email your password. Per VCU's Password Standard:
Passwords must be kept secret and must not be shared.
and
Passwords must not be inserted into email messages or other forms of electronic communication...
How does phishing affect me and VCU?
A number of users responded to the email, in some cases sending their VCU eID password to the phisher, in some cases to the VCU student's email account which had been compromised and in some cases to the VCU Information Security Officer.
When VCU IT staff become aware of a VCU user who shared their password, their password is expired for their own safety so that an unauthorized person can't use it.
Once an unauthorized person has your username and password, they can use it to access systems you have access to, which may give them access to your confidential data and university confidential data. Phishers will often use this access to send thousands of emails to others from your email account.
What if I receive a phishing email?
If you receive this email, or one like it, please delete it and do not respond to it. If you accidentally respond, change your password immediately and contact the VCU Help Desk to notify them that your password may have been compromised.
Want to learn more about phishing?
To learn more about phishing, including how phishing works, what phishers might ask for, how they'll encourage you to share information, signs of a phishing attack, how to protect yourself and what to do if you receive a phishing communication, visit Information Security's phishing page. And remember, VCU and other reputable organizations will never use email to request that you reply with your password, Social Security number or confidential personal information.
